CVE Vulnerability Catalog

The Download Monitor - WPForms Lock plugin version 1.0.4 and earlier contains an unauthenticated Cross-Site Scripting (XSS) vulnerability. An attacker can inject a malicious script that executes in the victim's browser.

The Coaching plugin version 3.9.2 and earlier contains an unauthenticated Cross-Site Scripting (XSS) vulnerability. An attacker can inject a malicious script that executes in the victim's browser.

The Funnel Kit Funnel Builder PRO plugin version 3.15.0.7 and earlier contains an unauthenticated Cross-Site Scripting (XSS) vulnerability. An attacker can inject a malicious script that executes in the victim's browser.

The Visitor Traffic Real Time Statistics Pro plugin version 11.9.1 and earlier contains an unauthenticated Cross-Site Scripting (XSS) vulnerability. An attacker can inject a malicious script that executes in the victim's browser.

The WP Booking System plugin versions below 5.12.8.1 contain a Broken Access Control vulnerability that allows subscribers unauthorized access to functions.

The eRoom plugin version 1.7.1 and earlier contains an SQL Injection vulnerability exploitable by users with Contributor role.

An SQL Injection (Improper Neutralization of Special Elements used in an SQL Command) vulnerability in the John-Michael L'Allier Create mediavine-create plugin allows Blind SQL Injection. This issue affects Create from n/a through 2.5.3.

In the libcupsfilters library, the cfIEEE1284NormalizeMakeModel() function enters an infinite loop when processing an IEEE-1284 device ID with an empty model field. A network-adjacent attacker can broadcast a crafted printer advertisement, causing denial of service.

A flaw in the odh-dashboard web component of Red Hat OpenShift AI (RHOAI) due to incorrect network binding allows a malicious actor within the cluster to bypass authentication and impersonate any user by providing an arbitrary access token.

Joomla Extension - tassos.gr - Sensitive data exposure in Convert Forms extension 2.5.0-5.2.2 - The front-end Submissions view did not enforce access control. An unauthenticated visitor could therefore list a form's submissions.

The Joomla Extension Modules Anywhere from regularlabs.com has inconsistent CSRF token checks and privilege checks. The editor popup could expose restricted module data to authenticated users without the required module permissions or valid request tokens.

The Articles Anywhere and Users Anywhere extensions for Joomla! cache query results without a time component, causing content leakage beyond its publication period.

In the ReReplacer Pro extension for Joomla!, insecure path handling allows reading files outside the site directory via XML include paths.

The GeoIP extension for Joomla! leaks MaxMind credentials in request URLs, leading to credential leakage.

The Joomla Extension GeoIP from regularlabs.com has inconsistent CSRF token checks and privilege checks. Database-update requests lacked consistent token and Super User checks, this could cause unauthorized updates.

The Articles Anywhere and Users Anywhere extensions for Joomla! download images from content-controlled URLs without validation, enabling SSRF and file writes to a web-accessible folder.

The MDJM Event Management plugin for WordPress up to version 1.7.8.4 contains a privilege escalation vulnerability due to missing capability checks and nonce verification in the `MDJM_Permissions::set_permissions()` and `MDJM_Employee_Manager::init()` functions, allowing unauthenticated attackers to grant arbitrary MDJM capabilities to any WordPress role and escalate to Administrator.

RRSIGs with too few labels can lead to bypass of DNSSEC wildcard validation.

OS command injection vulnerability in TUBITAK BILGEM pardus-update allows remote command execution.

A missing authentication check in Bosch IP cameras of families CPP13 and CPP14 allows an unauthenticated attacker to retrieve video analytics event data.